5

I have Apex-code which generates new user accounts, and it specifies a user-provided password for the account.

On first login the users are prompted to change the password, which is a painful extra step in our current workflow.

How do I prevent users being forced to set a new password?

My Apex looks like this:

User usr = new User(
   <<fields populated>>                                           
);

// Set the DML options to prevent e-mail to new user
Database.DMLOptions dlo = new Database.DMLOptions();
dlo.EmailHeader.triggerUserEmail = false;


//Insert new user
Database.SaveResult sr = Database.insert(usr,dlo);
if (sr.isSuccess()) {   
    String errString = '';

try {
    //Get user Id
    Id usr_sfid = sr.getId();
    if (usr_sfid == null) 
    {
        errString = 'Error setting password  (username: ' + username + ') - Could not get Id to set User pwd.';
        System.debug(errString);
    }
    else
    {           
        System.setPassword(usr_sfid, usr_password);   
    }
}
catch(Exception e) {
    errString = 'Error setting password (username: ' + username + ')' + e.getMessage();
    System.debug(errString);
}
4

This is "Working as Designed" in terms of Salesforce functionality. Any time a new user is created or their password is reset, it's expected they'll be prompted to create a new password of their own choosing when they next log-in.

This is largely for security reasons should a user not receive the email they were sent or should it be sent to the wrong email address. These messages usually have an expiration date-time on them, after which the password that's included/embedded expires. Additionally, you don't want an email sitting around that someone else might be able to access at another time that contains a link which allows them to access the user's secure Salesforce Account.

  • 1
    Thanks for your response. Unfortunately in our case 90% of the users don't have an e-mail address (part of why I set triggerUserEmail = false), and will only ever access SF via a custom mobile app we've written, which uses the SF login page. They're non-technical users, and in some cases our app is one of the first mobile apps they're using. Having to create a new password (and specify a security question) becomes a barrier to them engaging with the app. Is there any way you're aware of to workaround this functionality? – Andrew Apr 12 '17 at 13:53
  • Unfortunately, for your use case, there's none that I'm aware of. As I stated in my answer, this is working as designed. I recommend you file a case with Salesforce Support to see what they can advise you. I'm confident this is something that if it's even possible for them to do, they'd need to enable some kind of special functionality for you. – crmprogdev Apr 12 '17 at 15:54
0

I know this is an old question, but I was wondering the same thing and realised this may help someone.

Technically the users are not forced to create a new password, as they can simply click the 'cancel' button on the page that comes up. This means the password is not changed, and the user is then presented with their Salesforce home screen. Not ideal, but at least the users can get away from it if they know creating a new password is optional.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.